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REMARKS 



Claims 1 to 9 and 11 were pending in the application at 
the time of examination. Claims 1 to 3, 5, 6 and 11 stand 
rejected as anticipated. Claims 7 to 9 stand rejected as 
obvious. No rejection of Claim 4 was presented. 

To avoid discussions on whether Applicants are requesting 
limitations to be read from the specification into the claims^ 
Applicants have amended Claims 1 to 4, 6 to 9 and 11 to make 
explicit what was implicit in the claims. The amendments are 
supported, for example, at least by Fig. 7. 

Claims 1 to 3, 5, 6 and 11 stand rejected under 35 U.S.C. 
§ 102(e) as being anticipated by U.S. Patent No. 6,484,260 of 
Scott et al., hereinafter referred to as "Scott." 

The rejection stated: 

As per claims 1-3, 5-6 and 11, '260 teaches a method 
and apparatus for security in a data processing system 
comprising: privacy protection, identification, enrolling 
for a service, a randomized identifier, a communication 
network, a storage device, a smart card/PID, authority 
ID/content provider, network servers, cryptograms /keys, 
credential data, credential request, verification, peer 
group/trusted third party server, and service provider, 
see figs 1-3, 4A, 7-8, abs., summary, col. 6, and col. 10- 
11. 



Applicants respectfully traverse the anticipation 
rejection of Claim 1. Applicants respectfully note that it is 
not enough that Scott teach generally the list of items cited 
in the rejection, rather the MPEP requires: 

TO ANTICIPATE A CLAIM, THE REFERENCE MUST TEACH EVERY 
ELEMENT OF THE CLAIM 
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''A claim is anticipated only if each and every 
element as set forth in the claim is found, either 
expressly or inherently described, in a single prior art 
reference." . . . ''The identical invention must be shown 
in as complete detail as is contained in the ... claim." 
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Richardson v. Suzuki Motor Co., 868 F.2d 1226, 1236, 9 
USPQ2d 1913, 1920 (Fed. Cir. 1989). The elements must be 
arranged as required by the claim, but this is not an 
ipsissimis verbis test, i.e., identity of terminology is 
not required. In re Bond, 910 F.2d 831, 15 USPQ2d 1566 
(Fed. Cir. 1990) . 
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MPEP § 2131, 8th Ed. Rev. 5, p. 2100-67 (August 2006) . The 
MPEP is unequivocal, Scott must show the invention in the same 
detail as recited in Claim 1 and Scott must show the elements 
arranged as required by Claim 1. Scott fails to meet both of 
these requirements. 

While Scott does describe generation of a large random 
number at Col. 11, line 66, for example, the process of Scott 
is fundamentally different from that recited in Claim 1. Scott 
first taught that it was necessary for a user to enroll with 
the PID. See Scott, Col. 9, line 54 to Col. 10, line 5. This 
enrollment is not with an authority over a data communications 
network as recited in Claim 1. The enrollment taught by Scott 
generates a fingerprint template and not a randomized ID as 
recited in Claim 1. Therefore, Scott expressly considered 
enrollment of a user and it was a fundamentally different 
process from that recited in Claim 1. 

Scott also described registration with a host facility. 
Assuming the Office redefines the registration of Scott as 
enrollment, despite the fact that Scott described explicitly 
what constituted enrollment, Scott taught with respect to 
registration: 

If a host system 30, such as a bank, a store, or a 
credit card company, implements this system, it would have 
the users register by presenting themselves with their PID 
6 and the required personal identification papers, which 
is no different than current methods of obtaining a bank 
card to access accounts with an ATM. The bank or other 
host system 30 would ask the user to complete a verify on 
their PID 6 and read the ID code and test the send and 
receive of the encryption codes. This would establish the 
public key with the bank and confirm the private key in 
PID 6. The user is now ready to use the system. Note that 
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the bank does not have the user^s fingerprint template- -it 
only has the ID code and the public encryption key. 
(Emphasis Added.) 
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Scott, Col. 11, lines 46 to 58. This registration process of 
Scott does not use a randomized ID and is not performed over a 
data communications network. The user was required to present 
themselves at the service provider. Thus, neither the 
enrollment nor registration processes of Scott teach the 
enrolling of Claim 1. Accordingly, Scott fails to teach the 
invention of Claim 1 as required by the MPEP. 

The random number generated by Scott is part of a 
verification process, i.e., Scott stated "After the user 
registers, verification is as described above." Scott, Col. 
60, line 60. This verification process is performed by the 
host system, bank, store, etc. Scott expressly taught an 
enrollment process and a registration process that teaches away 
from the enrollment of Claim 1. In addition, Scott 
distinguishes between enrollment, registration and 
verification. Accordingly, citing to part of a verification 
process, as in the rejection of Claim 1, fails to teach 
anything concerning enrolling. Further, the verification 
process is done by the provider of the service and not an 
authority as recited in Claim 1. Accordingly, Scott fails to 
teach or suggest the invention of Claim 1 at multiple levels. 
Applicants respectfully request reconsideration and withdrawal 
of the anticipation rejection of Claim 1. 

Claims 2 and 3 include limitations similar to those 
described above with respect to Claim 1. Accordingly, the 
above comments with respect to Claim 1 are applicable to each 
of these claims and so are incorporated herein by reference. 
Applicants respectfully request reconsideration and withdrawal 
of the anticipation rejection of each of Claims 2 and 3. 

As noted above there is no substantive rejection of 
Claim 4 in the action. 
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With respect to the anticipation rejection of Claim 5, 
Claim 5 recites in part: 

credential data; 

an authority peer group ID that identifies an 
entity that provided data authentication for said 
credential, said entity comprising a one or more 
network servers in a data communications network, one 
of said one or more network servers providing data 
authentication for said credential; and 

a cryptogram provided by said entity and used to 
authenticate said credential data. 

To anticipate Claim 5, Scott must include a teaching of a 
structure that includes this information in the same level of 
detail as recited in the claim according to the above 
quoatation from the MPEP. Scott taught: 



The memory in the smart card stores a fingerprint template 
representative of the fingerprint of an enrolled person, 
and an ID code and a personal encryption key being 
associated with the device 



Scott, Col. 2, lines 56 to 59. 



Memory 2 0 stores information that is specific to 
processing unit 16. Memory 20 stores an ID code that is 
set in PID 6 by the manufacturer. The ID code of a device, 
which may be the device serial number, is unique to each 
device. Memory 2 0 also stores a fingerprint template that 
is generated by processing unit 16 from a fingerprint 
image signal provided by optics 12 unit when an individual 
first enrolls into PID 6, as will be described in detail 
below. 
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Scott, Col. 6, lines 54 to 61. 

Thus, Scott taught that the ID stored is not "an authority 
peer group ID," but rather an ID code of the device. If the 
Examiner continues the rejection, the Examiner is respectfully 
requested to cite with specificity what is considered the 
credential data, the authority peer group ID, and the 
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cryptogram in view of the above quoted teachings of Scott . 
Applicants respectfully request reconsideration and withdrawal 
of the anticipation rejection of Claim 5. 

Applicants respectfully traverse the anticipation 
rejection of Claim 6. The comments above with respect to a 
randomized identifier are incorporated herein by reference. 
Further, the rejection has failed to cite any teaching of 

said credential comprising: 

a randomized identifier; 
credential user data; and 

an indication of the credential user data 
verification performed by said authority in response 
to said credential request. 

The enrollment and registration processes of Scott are not 
done with an authority over a data communication networks as 
noted above and incorporated herein by reference. The 
randomized number generated by Scott in the verification is not 
part of a credential provided by such an authority. Therefore, 
Scott fails to teach the invention in the same level of detail 
as recited in Claim 6. Applicants request reconsideration and 
withdrawal of the anticipation rejection of Claim 6. 

Applicants respectfully traverse the anticipation 
rejection of Claim 11. Scott taught that the public encryption 
key for the device could be provided to trusted third parties. 
The third party provides the public key for the device, but 
Scott fails to teach anything concerning verifying the 
enrollment. Claim 11 recites in part: 
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. . . said service provider capable of 
communicating with said enrollment authority to 
verify said enrollment results, said service provider 
configured to provide said service based upon said 
enrollment results and a response from said 
enrollment authority (Emphasis added) 
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The rejection has failed to cite any teaching of a service 
provider that is capable of communicating with an enrollment 
authority and that can provide a service based on a response 
from the enrollment authority and the enrollment results. 
Scott makes a point of saying that the enrollment results are 
not disclosed and remain on the user device. Obtaining a 
public key for a device fails to teach the service provider in 
the same level of detail as recited in Claim 11. Accordingly, 
the rejection fails to demonstrate that the reference teaches 
the invention in the same level of detail as recited in Claim 
11. Applicants respectfully request reconsideration and 
withdrawal of the anticipation rejection of Claim 11. 

Claims 7 to 9 stand rejected under 35 U.S.C. s 103(a) as 
being unpatentable over Scott in view of U.S. Patent 
Application Publication No. 2003/0039361 of Hawkes et al . , 
hereinafter '361. 

Applicants respectfully traverse the obviousness of Claims 
7 to 9 . Applicants note that in relying upon '361, the 
Examiner provided parallel cites to the earlier '591 
publication (U.S. Patent Application Publication No. 
2002/0141591 Al) . 

Assuming that the- kerberos ticket of the secondary 
reference is implemented in Scott in conjunction with the 
random number, this combination fails to teach or suggest the 
authority or the service provider of Claim 7 and the operations 
with these entities. As noted above, the random ID is not 
provided by authority, but rather the host from which services 
are being sought. Therefore, assuming the combination of 
references is correct, the combination fails to suggest the 
invention of Claim 7. Applicants respectfully request 
reconsideration and withdrawal of the obviousness rejection 
Claim 7. 

Claims 8 and 9 include limitations similar to those 
described above with respect to Claim 7. Accordingly, the 
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above comments with respect to Claim 7 are applicable to each 
of these claims and so are incorporated herein by reference. 
Applicants respectfully request reconsideration and withdrawal 
of the obviousness rejection of each of Claims 8 and 9. 

Claims 1 to 9 and 11 remain in the application. Claims 1 
to 4, 6 to 9 and 11 have been amended. Claim 10 has been 
cancelled. For the foregoing reasons, Applicant (s) respectfully 
request allowance of all pending claims. If the Examiner has 
any questions relating to the above, the Examiner is 
respectfully requested to telephone the undersigned Attorney 



for Applicant (s) . 

CERTIFICATE OF MAILING 
I hereby certify that this correspondence is 
being deposited with the United States Postal 
Service with sufficient postage as first class 
mail in an envelope addressed to: Commissioner 
for Patents, P.O. Box 1450, Alexandria, VA 
22313-1450, on February 9, 2007. 
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Attorney for Applicant (s) 
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